Tor Exit Nodes Hit by Large-Scale DDoS Attacks From the UK

Several operators have reported that their Tor exit nodes have been hit by large-scale DDoS attacks originating in the UK. While some abnormalities have been written off by users as “graph glitches”, the attacks have coincided with the disappearance of the Abraxas Marketplace, which has made some users quite edgy.

An anonymous operator posted to Pastebin:

“Hi, I am the operator of several exit nodes and would like to stay anonymous due to the nature of the given attacks. Since Thursday (05.11.2015 1800 UTC) I have seen large DDoS attacks on each of my exit nodes from a common /16 source. The attacks originate from UK.”

The same operator, under the username dipsh1t, later posted more details to the /r/DarkNetMarket subreddit, writing, “[Attacks are occurring at an] Interval of about 30min. A whole bunch of IPs at 20mbit/s hitting hard for 5min. And then a small amount of nodes hitting hard at around 100mbit/s per IP. They’re both TCP and UDP, primarily UDP. All nodes look identical (nmap).”

If these attacks are both legitimate and being launched by the UK, it comes a week after the launch of a new task force by UK intelligence service GCHQ to police the ‘dark web’. “An NCA and GCHQ co-located Joint Operations Cell (JOC) opens officially today,” a National Crime Agency press release from 6th November reads. “The unit brings together officers from the two agencies to focus initially on tackling online child sexual exploitation.”